A permission control method based on RBAC, a model establishment method and a device

Abstract

The present invention discloses a permission control method based on RBAC, a method for establishing a model, and an apparatus. The method comprises: receiving a request signal and confirming the permission space and permission space sequence number corresponding to the request signal; the request signal is a signal generated when a user requests a permission operation; determining whether the role corresponding to the user contains the permission space; if so, obtaining the permission variable corresponding to the permission space; obtaining the permission variable value according to the permission space sequence number; determining whether the permission variable value is the same as the preset permission variable value of the role; if so, generating a permission signal. The permission control method described in the above embodiment of the present invention can solve the accuracy and fine-grainedness problems of permissions and realize precise control of permissions.

Description

Technical Field

[0001] The present invention relates to the field of computer software, and in particular to a permission control method based on RBAC, a model establishment method and a device. Background Art

[0002] RBAC stands for role-based access control. In RBAC, permissions are associated with roles. Users gain the permissions of appropriate roles by becoming members of those roles. This greatly simplifies permission management. Because RBAC-based management hierarchies are interdependent, assigning permissions to roles, and then assigning roles to users, creates a clear and manageable permission design.

[0003] The RBAC model is a broad subject model that defines the relationships between users, roles, and permissions. RBAC1, RBAC2, and RBAC3 extend this model. RBAC1, RBAC2, and RBAC3 are essentially extensions of roles, including role inheritance and role constraints. There are no detailed regulations regarding the specific implementation of permissions. Currently, the industry's typical approach to permissions is to control permissions across three dimensions: menus, buttons, and data permissions. Menus and buttons are controlled through RBAC-compliant role management, while data permissions can only be implemented at the non-RBAC organizational level. Other approaches implement data permissions separately. Alternatively, RBAC-compliant permissions are implemented through roles, meaning the RBAC model only implements simple data permission control. However, this approach to permission control lacks the precision and granularity to control functional and data permissions.

[0004] Informatization, digitization, and intelligence are the development trends of today's society. With the popularization of data and networks, data security and network security are becoming increasingly important. Users must be able to access data and networks more accurately and promptly. User permission control is a key means of ensuring security, and the accuracy, timeliness, and efficiency of user permissions are even more important. Therefore, a new permission control method is needed to address these issues. Summary of the Invention

[0005] The purpose of the present invention is to provide an RBAC-based permission control method, model establishment method and device to solve the problem that the traditional RBAC model in the prior art is insufficient in accuracy and granularity in controlling functional permissions and data permissions.

[0006] To achieve the above object, the present invention provides a permission control method based on RBAC, the method comprising:

[0007] Receive a request signal and confirm the permission space and permission space serial number corresponding to the request signal; the request signal is a signal generated when a user requests a permission operation, and the permission space is a permission control point;

[0008] Determine whether the role corresponding to the user contains the permission space;

[0009] If so, obtaining the permission variable corresponding to the permission space; the permission variable represents the attribute of the permission operation;

[0010] Obtaining the permission variable value according to the permission space sequence number;

[0011] Determine whether the authority variable value is the same as the preset authority variable value of the role;

[0012] If so, a permission signal is generated.

[0013] Optionally, the permission operation includes: function permission and / or data permission; and generating the permission signal includes:

[0014] Generate an operation signal according to the functional authority to enable the user to perform the permission operation, and / or obtain data corresponding to the data authority and return it to the user.

[0015] Optionally, the acquiring the data corresponding to the data permission and returning it to the user includes:

[0016] Acquire first data, where the first data is an intersection of obtainable data corresponding to the permission variables under the same permission space sequence number;

[0017] For any permission space corresponding to the data permission, take the union of the first data controlled by the sequence numbers of the permission spaces corresponding to the data permission to obtain the second data;

[0018] Taking a union of the second data controlled by each permission space corresponding to the data permission to obtain third data;

[0019] The third data is returned to the user.

[0020] Optionally, the method further includes:

[0021] Determining a resource corresponding to the request signal; the resource represents an event requiring permission control;

[0022] A permission space corresponding to the resource is acquired based on the resource.

[0023] Optionally, the method further includes:

[0024] Obtaining a timeliness object; the timeliness object is used to define the validity of an object; the object includes: users, roles, resources, permission spaces, permission variables, the correspondence between users and roles, the correspondence between roles and resources, the correspondence between resources and permission spaces, the correspondence between roles and permission spaces, and the correspondence between permission spaces and permission variables;

[0025] The effective object is calculated based on the time-sensitive object.

[0026] Optionally, the method further includes: generating a no-authorization result when the role corresponding to the user does not include the permission space or when the permission variable value is different from the preset permission variable value.

[0027] The present invention provides a permission control device based on RBAC, the device comprising:

[0028] A receiving unit, configured to receive a request signal and confirm the permission space and permission space sequence number corresponding to the request signal; the request signal is a signal generated when a user requests a permission operation, and the permission space is a permission control point;

[0029] A first judging unit, configured to judge whether the role corresponding to the user includes the permission space;

[0030] A first acquiring unit is configured to acquire a permission variable corresponding to the permission space; the permission variable represents an attribute of the permission operation;

[0031] A second obtaining unit, configured to obtain a permission variable value according to the permission space sequence number;

[0032] A second judgment unit is used to judge whether the authority variable value is the same as the preset authority variable value of the role;

[0033] A generating unit is configured to generate a permission signal if yes.

[0034] The present invention provides a method for establishing an authority control model based on RBAC, the method comprising:

[0035] Establishing an authority space; the authority space is an authority control point;

[0036] Establishing roles, and establishing associations between users and roles, and between the roles and the permission space;

[0037] Establishing an authority variable and establishing an association relationship between the authority space and the authority variable;

[0038] Set one or more permission variable values corresponding to the permission variable;

[0039] A corresponding relationship between the permission variable value and the permission space sequence number is established.

[0040] Optionally, the method further includes: establishing resources corresponding to the permission space; the resources represent events that require permission control.

[0041] Optionally, the method includes:

[0042] Create a time-limited object;

[0043] Establish an association relationship between time-limited objects and objects; the time-limited objects are used to define the validity of the objects; the objects include: users, roles, resources, permission spaces, permission variables, the correspondence between users and roles, the correspondence between roles and resources, the correspondence between resources and permission spaces, the correspondence between roles and permission spaces, and the correspondence between permission spaces and permission variables.

[0044] The present invention also provides a device for establishing an RBAC-based authority control model, the device comprising:

[0045] A first establishing unit is used to establish an authority space; the authority space is an authority control point;

[0046] A second establishing unit is used to establish a role, and establish an association relationship between the user and the role, and an association relationship between the role and the permission space;

[0047] A third establishing unit is used to establish an authority variable and establish an association relationship between the authority space and the authority variable;

[0048] A setting unit, configured to set one or more permission variable values corresponding to the permission variable;

[0049] The fourth establishing unit is used to establish a corresponding relationship between the permission variable value and the permission space sequence number.

[0050] The present invention also provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of the RBAC-based permission control method described in any one of the above items and / or the method for establishing an RBAC-based permission control model described in any one of the above items are implemented.

[0051] The present invention also provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any of the above-mentioned RBAC-based permission control methods and / or any of the methods for establishing an RBAC-based permission control model.

[0052] The present invention provides a permission control method based on RBAC, a method for establishing a model and a device, which improves the accuracy and fine-grainedness of permission control by defining a permission space as a permission control point, including permission variables under the permission control point and determining the permission variable value by the permission space sequence number. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a flow chart of a permission control method based on RBAC according to one embodiment of the present invention;

[0054] Figure 2 This is a flow chart of a permission control method based on RBAC according to one embodiment of the present invention;

[0055] Figure 3 is a relationship model diagram between objects and time-sensitive objects according to an embodiment of the present invention;

[0056] Figure 4 1 is a structural diagram of an RBAC-based permission control device according to an embodiment of the present invention;

[0057] Figure 5 This is a flow chart of a method for establishing an RBAC-based authority control model according to one embodiment of the present invention;

[0058] Figure 6 This is a structural diagram of a device for establishing an RBAC-based authority control model according to an embodiment of the present invention;

[0059] Figure 7 This is a structural diagram of an RBAC-based permission control model according to an embodiment of the present invention;

[0060] Figure 8 is a structural diagram of a computer device according to one embodiment of the present invention. DETAILED DESCRIPTION

[0061] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings, but it should be understood that the protection scope of the present invention is not limited by the specific embodiments.

[0062] Unless expressly stated otherwise, throughout the specification and claims, the term "comprise" or variations such as "include" or "comprising", etc., will be understood to include the stated elements or components but not to exclude other elements or other components.

[0063] According to an optional embodiment of the present invention, a permission control method based on RBAC is as follows: Figure 1 As shown, the method includes:

[0064] Step 101, receive a request signal and confirm the permission space and permission space serial number corresponding to the request signal; the request signal is a signal generated when the user requests a permission operation, and the permission space is a permission control point. Specifically, when the user needs to operate a certain function, first send a request signal to the server to request permission, and the obtained permission can be used to operate the function. After the server receives the request signal sent by the user, it is necessary to confirm whether the user has the corresponding operation permission based on the request signal. Here, it is necessary to confirm the permission space corresponding to the request signal based on the request signal. In a specific embodiment of the present invention, the permission space is a permission control point, which represents a permission of the smallest granularity, and represents the fine-grained minimum division of the control of a specific permission into the permission space. Dividing the user's permissions into several permission spaces to define multiple permissions of the user through the permission space provides fine-grained permission control, making it more accurate when granting permissions.

[0065] Step 102, determine whether the role corresponding to the user contains the permission space. Specifically, the user and the role corresponding to the user can be identified based on the request signal sent by the user end. Users and roles can correspond one to one or many to many, that is, the same user may have different roles in different situations, and different roles have a mapping relationship with different permission spaces, and roles and permission spaces can also correspond one to one or many to many, that is, a role has different permission spaces, and a permission space can also correspond to multiple roles. In this way, the permission spaces corresponding to the same user under different roles may be different. If it is necessary to confirm whether the user has the permission corresponding to the permission space, it is necessary to determine whether the permission space confirmed in step 100 is included in the multiple roles corresponding to the user to determine whether the role and permission space corresponding to the user in this scenario have a corresponding relationship.

[0066] Step 103, if yes, then obtain the permission variable corresponding to the permission space; the permission variable represents the attribute of the permission operation. Specifically, the permission variable is a permission control attribute, which can be a function permission control attribute or a data permission control attribute. Under the permission control point of the smallest granularity, the permission space also includes a flexible permission control attribute, the permission variable, to further solve the accuracy and granularity of permissions. Specifically, the permission space usually combines one or more permission variables to control specific operation permissions. Among them, the permission space and the permission variable can be a one-to-one relationship, a one-to-many relationship, or a many-to-many relationship, which is applied according to specific needs.

[0067] Step 104, obtain the permission variable value according to the permission space serial number. Specifically, the permission variable may include one or more permission variable values. The permission variable value can satisfy the user's needs and clarify the specific role of the role by limiting the assignment range of the permission variable value during the initial setting. The permission space serial number corresponds to the permission variable value. The permission space can determine its corresponding permission space serial number, and then determine the specific assignment of the permission variable corresponding to the permission space, that is, the permission variable value, through the permission space serial number. For example, when permission space A corresponds to two permission space serial numbers 1 and 2, and the permission space A corresponds to three permission variables X, Y, and Z, then the permission variable values of permission variables X, Y, and Z can be determined by permission space serial numbers 1 and / or 2, respectively.

[0068] Step 105, determine whether the permission variable value is the same as the preset permission variable value of the role. Specifically, after obtaining the permission variable value, it is still necessary to determine whether the variable value of one or more permission variables is the same as the preset permission variable value of the user to further determine the specific permission of the user, that is, through top-down multi-layer permission screening, precise control of permissions is achieved. In the embodiment of the present invention, different permission variable values further subdivide permissions, so that permission operations are more subdivided and specific, which is convenient for application in different scenarios or systems.

[0069] Step 106: If yes, generate an authorization signal.

[0070] When it is determined in step 105 that the authority variable value is the same as the preset authority variable value of the role, it means that the user has the authority, and thus the authority is authorized to the user by generating a permission signal.

[0071] The above-mentioned embodiment of the present invention performs permission judgment based on the user's role to confirm the user's permission scope, and at the same time defines the permission space as the permission control point, and judges the permission scope through the mutual relationship between the user, role and permission space, so as to solve the accuracy and granularity problems of permissions and realize precise control of permissions.

[0072] In another optional embodiment of the present invention, a method for controlling permissions based on RBAC is described, wherein the permission operation includes: functional permissions and / or data permissions; and the generating of permission signals includes: generating an operation signal based on the functional permissions to enable the user to perform the permission operation and / or obtain data corresponding to the data permissions and then returning the signal to the user. In a specific embodiment, when the permission variable value corresponding to the permission variable is the same as the preset permission variable value of the user, different signals or data can be provided depending on whether the permission operation requested in the request signal sent by the user end is a functional permission or a data permission. For example, when the permission operation is a functional permission, the corresponding operation function will ultimately be provided to the user, that is, the user can perform an operation on a certain permission; if the permission operation is a data permission, that is, the permission operation requested by the user end is to obtain a certain data or a certain type of data, the corresponding data will be obtained based on the permission variable and provided to the user end for the user to view. This embodiment of the present invention clearly refines the user's functional permissions and data permissions, improving the security, timeliness, and efficiency of the system.

[0073] The RBAC-based permission control method described in the specific embodiment of the present invention is optional, such as Figure 2 As shown, the acquiring of data corresponding to the data authority and returning the data to the user includes:

[0074] Step 107: Obtain the first data, which is the intersection of the available data corresponding to the permission variables under the same permission space sequence number. Specifically, when requesting a data permission operation, since the permission control point is the permission space, when the permission space contains only one permission space sequence number, the available data corresponding to all permission variables under the permission space sequence number are mutually exclusive, that is, the same available data is the first data corresponding to the permission space sequence number, and different data under each permission variable is not the first data of the permission space sequence number. Therefore, it is necessary to take the intersection of the available data corresponding to multiple permission variables in the same permission space sequence number to obtain the first data under the permission space sequence number.

[0075] Step 108: For any permission space corresponding to the data permission, take the union of the first data controlled by each permission space number corresponding to the data permission to obtain the second data. When there are multiple permission space numbers, the data required by the user is the sum of the first data corresponding to each permission space number. That is, the union of the first data corresponding to a single permission space number is used as the second data;

[0076] Step 109: Take the union of the second data controlled by each permission space corresponding to the data permission to obtain third data. Specifically, when a permission space corresponds to multiple permission space numbers, that is, the data permission to be obtained is multiple second data, the union of all the required second data is obtained through step 109 to obtain the third data. The third data is all the data required by the user.

[0077] Step 110: Return the third data to the user. The user can now obtain the data corresponding to the data permission.

[0078] The RBAC-based permission control method described in a specific embodiment of the present invention may, optionally, after obtaining the role corresponding to the user information, further include:

[0079] Confirm the resource corresponding to the request signal; the resource represents an event that requires permission control. Specifically, a resource can be any event that requires permission control, such as a menu in an information system, a port number on a gateway, a video on a video website, etc. Taking the ERP system as an example, resources can refer to menus, interfaces, reports, etc. of the system. Menus can be menus such as "Material Procurement Management" and "Material Inventory Management". Interfaces can be interfaces such as "Material Query", "Material Addition", and "Material Modification". Therefore, the permission space corresponding to the resource is obtained based on the resource. This embodiment is different from the above embodiment. The permission space and the role are connected through resources, that is, the role and the resource, and the resource and the permission space have an association relationship respectively. For example, the role and the resource have an association relationship, and the resource and the permission space have an association relationship, so as to increase the sophistication of permission control through different resources.

[0080] Based on the resource, the permission space corresponding to the resource is obtained. In a specific embodiment of the present invention, the permission space corresponding to the resource is searched through the resource corresponding to the role, and finally the permission space corresponding to the role is obtained. For example, if the resource is a material procurement management menu, it corresponds to the creation of the material procurement management permission space s_materil and the creation of the material inventory management permission space s_stock, that is, the material procurement management menu resource corresponds to the permission spaces s_materil and s_stock.

[0081] The RBAC-based permission control method described in a specific embodiment of the present invention may optionally further include:

[0082] Obtaining a timeliness object; the timeliness object is used to define the validity of an object; the object includes: users, roles, resources, permission spaces, permission variables, the correspondence between users and roles, the correspondence between roles and resources, the correspondence between resources and permission spaces, the correspondence between roles and permission spaces, and the correspondence between permission spaces and permission variables;

[0083] The effective object is calculated based on the time-sensitive object.

[0084] In a specific embodiment, a time-limited object is a definition of the validity of the object to which it belongs, which can be a period of time, several conditions or a specific environment. In a specific embodiment of the present invention, if Figure 3 As shown, the timeliness object can act on all objects or some objects in the model. The objects include users, roles, resources, permission spaces, and permission variables, as well as the correspondence between users and roles, the correspondence between roles and resources, the correspondence between resources and permission spaces, the correspondence between roles and permission spaces, and the correspondence between permission spaces and permission variables. Through the above specific embodiments, system administrators or operators can create and modify the timeliness of objects at any time. When the timeliness requirements are met, the permissions automatically take effect or expire, without the need for manual operation on time, which greatly improves the security and efficiency of the system.

[0085] The RBAC-based permission control method described in the specific embodiment of the present invention may optionally further include: generating a no-authorization result when the role corresponding to the user does not contain the permission space or when the variable value of the permission variable is different from the user's preset permission variable value. The no-authorization result means that the user does not have the requested permission, that is, has no right to obtain permission. For example, the role does not contain the permission space or the permission variable value of the permission variable is different from the user's preset permission variable value, both of which are cases of no right to obtain permission.

[0086] The specific embodiment of the present invention provides a permission control device based on RBAC, such as Figure 4 As shown, the device includes:

[0087] Receiving unit 401, configured to receive a request signal and confirm the permission space and permission space sequence number corresponding to the request signal; the request signal is a signal generated when a user requests a permission operation, and the permission space is a permission control point;

[0088] A first determining unit 402 is configured to determine whether the role corresponding to the user includes the permission space;

[0089] The first acquiring unit 403 is configured to acquire a permission variable corresponding to the permission space; the permission variable represents an attribute of the permission operation;

[0090] A second obtaining unit 404 is configured to obtain a permission variable value according to the permission space sequence number;

[0091] The second judging unit 405 is used to judge whether the authority variable value is the same as the preset authority variable value of the role;

[0092] The generating unit 406 is configured to generate an authorization signal if yes.

[0093] The specific embodiment of the present invention also provides a method for establishing a permission control model based on RBAC, such as Figure 5 As shown, the method further includes:

[0094] Step 501: Establish a permission space, which is a permission control point. Specifically, a permission space is the smallest permission control point, representing the fine-grained division of control permissions into permission spaces. Dividing a user's permissions into several atomic permission spaces allows multiple permissions to be defined within the permission space, providing fine-grained permission control and enabling more precise authorization.

[0095] Step 502: Establish roles, and establish associations between users and roles, as well as between roles and permission spaces. Specifically, users and roles can correspond one-to-one or many-to-many, meaning the same user may have different roles in different situations, and different roles are mapped to different permission spaces. Roles and permission spaces can also correspond one-to-one or many-to-many, meaning one role has different permission spaces, and one permission space can correspond to multiple roles. In this way, an association between a user and one or more roles is established, and associations between roles and multiple permission spaces are established under different roles.

[0096] Step 503, establish permission variables, and establish an association relationship between the permission space and the permission variables. Specifically, the permission variable is a permission control attribute, which can be a functional permission control attribute or a data permission control attribute. A single permission variable cannot constitute an executable specific permission, and a combination of multiple permission variables corresponding to a permission space is required to achieve a specific permission. Under the permission control point of the smallest granularity, the permission variable, a flexible permission control attribute, is established to further solve the accuracy and granularity problems of permissions. Specifically, the permission space usually combines one or more permission variables to control specific operation permissions. Among them, the permission space and the permission variable can be a one-to-many or many-to-many relationship, which is created according to specific needs.

[0097] Step 504: setting one or more permission variable values corresponding to the permission variable;

[0098] Step 505: Establish a correspondence between the permission variable value and the permission space serial number. Specifically, the permission variable may include one or more permission variable values. During initial setting, the permission variable value is limited in its assignment range to meet user needs and clarify the specific role of the role. Different permission variable values of the permission variable are paired with the permission space serial number.

[0099] The permission control model established in the above embodiment of the present invention defines the permission space as the minimum permission control point, and divides the permission scope according to the mutual relationship between users, roles and permission space, so as to solve the accuracy and granularity problems of permissions and realize precise control of permissions.

[0100] The method for establishing an RBAC-based permission control model described in a specific embodiment of the present invention also includes: establishing resources corresponding to the permission space; the resources represent events that require permission control. Specifically, resources can be any event that requires permission control, such as a menu in an information system, a port number on a gateway, a video on a video website, etc. Taking the ERP system as an example, resources can refer to menus, interfaces, reports, etc. of the system. Menus can be menus such as "Material Procurement Management" and "Material Inventory Management", and interfaces can be interfaces such as "Material Query", "Material Addition", and "Material Modification". This embodiment is different from the above embodiment. The permission space and the role are connected through resources, that is, the role and the resource, and the resource and the permission space have an association relationship respectively. For example, the role and the resource have an association relationship, and the resource and the permission space have an association relationship, so as to increase the precision of permission control through different resources.

[0101] A method for establishing an RBAC-based authority control model according to a specific embodiment of the present invention further includes:

[0102] Establishing a timeliness object: In a specific embodiment, a timeliness object is a definition of the validity of the object to which it belongs, which can be a period of time, several conditions, or a specific environment.

[0103] Establish an association relationship between a time-limited object and an object, wherein the time-limited object is used to define the validity of the object; the objects include: users, roles, resources, permission spaces, permission variables, the correspondence between users and roles, the correspondence between roles and resources, the correspondence between resources and permission spaces, the correspondence between roles and permission spaces, and the correspondence between permission spaces and permission variables. In a specific embodiment of the present invention, the time-limited object can act on all objects or some objects in the model, and the objects include users, roles, resources, permission spaces, and permission variables, as well as the correspondence between users and roles, the correspondence between roles and resources, the correspondence between resources and permission spaces, the correspondence between roles and permission spaces, and the correspondence between permission spaces and permission variables. Through the above specific embodiments, system administrators or operators can create and modify the timeliness of objects at any time. When the timeliness requirements are met, the permissions automatically take effect or expire, and there is no need for manual operation on time, which greatly improves the security and efficiency of the system.

[0104] The specific embodiment of the present invention also provides a device for establishing a permission control model based on RBAC, such as Figure 6 As shown, the device includes:

[0105] The first establishing unit 601 is used to establish an authority space; the authority space is an authority control point;

[0106] The second establishing unit 602 is used to establish a role, and establish an association relationship between the user and the role, and an association relationship between the role and the permission space;

[0107] The third establishing unit 603 is used to establish an authority variable and establish an association relationship between the authority space and the authority variable;

[0108] A setting unit 604, configured to set one or more authority variable values corresponding to the authority variable;

[0109] The fourth establishing unit 605 is configured to establish a corresponding relationship between the permission variable value and the permission space sequence number.

[0110] The present invention also provides a specific embodiment. First, based on the association between the permission space and the permission variable, the permission variable to be controlled under the permission space is established. Then, the permission variable value that can be assigned to the permission variable is confirmed and a one-to-one correspondence is made with the permission space sequence number. For example, the following permission variables and their assignable permission variable values are confirmed:

[0111] The permission variable function button (v_button) represents the function button of the material procurement management page. The possible permission variable values are query purchase order (query), add purchase order (add), modify purchase order (edit) and delete purchase order (del) buttons, etc.

[0112] The authority variable factory (v_factory) represents an enterprise or factory. The possible authority variable values are Daqing Petrochemical Enterprise (F001), Daqing Oil Production Plant No. 1 (F001002001), Daqing Oil Production Plant No. 2 (F001002002), Daqing Refining and Chemical Plant No. 3 (F001003003), etc.

[0113] The authority variable material type (v_materil_type) represents the type of industrial material. The possible authority variable values are heavy rail (M001), light rail (M002), large I-beam (M003) and H-beam (M004).

[0114] At this time, the permission space s_materil has the permission variables v_button, v_factory and v_materil_type.

[0115] In an optional embodiment, the role, the resources included in the role, the permission space corresponding to the resource, and the permission space sequence number corresponding to the permission space are also established, and the permission variable under the permission space is assigned a permission variable value to clarify the specific role. For example, the objects shown in Table 1 below are established:

[0116] Table 1

[0117]

[0118]

[0119] Establish an association between users and roles. For example, assign role A to operator A, roles B, C, and D to operator B, and roles B, D, and E to operator C.

[0120] In an optional embodiment, it also includes creating a time-limited object and creating a model and algorithm for the time-limited object. For example, a time period is used to model the model, and the model contains two conditions: the start time and the end time. If the current time is within the start time and the end time, it is confirmed to be valid, otherwise it is invalid. In a specific embodiment, the relationship between the time-limited object and the user, the user and the role, the role, the role and the resource, the resource, the resource and the permission space, the role and the permission space, the permission space, the permission space and the permission variable, and the permission variable are established, and the corresponding time-limited object is established according to the different characteristics of the thing. Figure 7 As shown, a timeliness object is created, modeled with timeliness attributes. The model includes two attributes: a start time and an end time. The attribute values are set to 2022-05-01 and 2022-05-02; alternatively, the start time is set to 2023-12-01 and the end time is set to 2023-12-08. If the current time is within the start and end time range, it is considered valid; otherwise, it is invalid. Subsequently, relationships are established between timeliness objects and users, users and roles, roles and resources, resources and permission spaces, roles and permission spaces, permission spaces and permission variables, and permission variables. Timeliness objects are created based on the characteristics of the objects. For example, a timeliness object M is added to a role, and a timeliness object M is added to the relationship between users and roles.

[0121] Preferably, the created user and role data is saved as a complete file in a unified data format and saved or copied. When applying user permission data, the user ID is directly retrieved from the cache, eliminating the data combination and calculation process. This embodiment performs this process in advance, improving the efficiency of permission operation. Preferably, the data format is JSON.

[0122] To illustrate the authority control method of an embodiment of the present invention, the present invention also provides a specific embodiment. The functional authority algorithm of operator C, operator C has roles B, D, and E. Before saving the purchase order to add to the database, an operation authority check is performed. First, check whether the time-limited objects of roles B, D, and E are valid. Assuming that all are valid, then check whether operator C has the permission space s_materil to create material procurement management. Since roles B, D, and E all have the permission space s_materil to create material procurement management, the next step is to check whether the value filled in the purchase order meets the user role requirements. If the factory filled in on the form is Daqing Oil Production Plant No. 1 (F001002001), the material is heavy rail (M001), and the operation is to add a purchase order (add), then first check the permission variable v_button corresponding to the permission space sequence number s_materil_1 in role B. The permission variable value is query, and query!=add, that is, role B does not meet the conditions. Next, we check the permission variable v_button for permission space number s_materil_1 in role D, and its value is add, which meets the requirement. We then check the permission variable v_factory for permission space number s_materil_1, and its value is F001002002. Since F001002002!=F001002001, role D does not meet the requirement. Finally, we check the permission variable v_button for permission space number s_materil_1 in role E, and its value is query. Since query!=add, role E does not meet the requirement. None of the roles meet the requirement. Finally, operator C does not have permission to add a purchase order for the plant: Daqing Oil Production Plant No. 1 (F001002001) and the material: heavy rail (M001). Using the same algorithm, if the factory filled in on the form is Daqing Oilfield No. 2 Plant (F001002002), the material is heavy rail (M001), and the operation is add purchase order (add), then operator C's role D meets the requirements, so operator C has the operation authority.

[0123] The following uses data permissions as an example to introduce a specific embodiment of the present invention. Assume that the purchase order table in the database contains the data shown in Table 2 below:

[0124] Table 2

[0125] Purchase Order Name Purchasing Factory Purchase material type Purchase Order 1 F001002001 M001 Purchase Order 2 F001002001 M002 Purchase Order 3 F001003003 M001 Purchase Order 4 F001003003 M002 Purchase Order 5 F001003002 M002

[0126] Operator C, who holds roles B, D, and E, performs a data permission check when querying purchase orders. First, the permissions for roles B, D, and E are checked for validity. Assuming all are valid, Operator C then checks whether they have the s_materil permission space. Since roles B, D, and E all have the s_materil permission space, the first step passes. The second step retrieves all data from the database table and checks whether the first entry meets the requirements. Since the permission operation for entry 1 is query, the corresponding permission variables for entry 1 have values of v_button = query, v_factory = F001002001, and v_materil_type = M001. These values are compared with the values for roles B, D, and E. If all three permission variables meet the requirements, Operator C is allowed to view the entry. The comparison loop continues through the roles, and since role B meets the requirements, Operator C is allowed to view the entry. By analogy, we find that the permission variable values corresponding to the fourth data item are v_button = query, v_factory = F001003003, and v_materil_type = M002. When compared with the preset permission variable values for the corresponding users of Role B, Role D, and Role E, none of them meet the requirements. Therefore, this data item cannot be viewed and the user does not have the permission to access this data item. The data that Operation C can finally obtain is shown in Table 3 below:

[0127] Table 3

[0128] Purchase Order Name Purchasing Factory Purchase material type Purchase Order 1 F001002001 M001 Purchase Order 2 F001002001 M002 Purchase Order 3 F001003003 M001 Purchase Order 5 F001003002 M002

[0129] like Figure 8The figure shows a computer device provided in an embodiment of this document. In the embodiment of this document, the permission control device can be a computer device in this embodiment, which performs the above-mentioned method of this document. The computer device 802 may include one or more processors 804, such as one or more central processing units (CPUs), each of which can implement one or more hardware threads. The computer device 802 may also include any memory 806, which is used to store any type of information such as code, settings, data, etc. For example, without limitation, the memory 806 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Furthermore, any memory can provide volatile or non-volatile retention of information. Furthermore, any memory can represent a fixed or removable component of the computer device 802. In one embodiment, when the processor 804 executes associated instructions stored in any memory or combination of memories, the computer device 802 can perform any operation of the associated instructions. The computer device 802 also includes one or more drive mechanisms 808 for interacting with any memory, such as a hard disk drive mechanism, an optical disk drive mechanism, etc.

[0130] The computer device 802 may also include an input / output module 810 (I / O) for receiving various inputs (via input devices 812) and for providing various outputs (via output devices 814). A specific output mechanism may include a presentation device 816 and an associated graphical user interface (GUI) 818. In other embodiments, the input / output module 810 (I / O), input devices 812, and output devices 814 may not be included, and the computer device 802 may simply be a computer device in a network. The computer device 802 may also include one or more network interfaces 820 for exchanging data with other devices via one or more communication links 822. One or more communication buses 824 couple the components described above together.

[0131] The communication link 822 may be implemented in any manner, for example, via a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 822 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc., governed by any protocol or combination of protocols.

[0132] An embodiment of the present invention also provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any of the above-mentioned permission control methods and / or any of the methods for establishing an RBAC-based permission control model.

[0133] It should be understood that in the various embodiments of this document, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this document.

[0134] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0135] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0136] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0137] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0138] The foregoing descriptions of specific exemplary embodiments of the present invention are for purposes of illustration and description. These descriptions are not intended to limit the invention to the precise forms disclosed, and it is apparent that many variations and modifications are possible in light of the foregoing teachings. The exemplary embodiments have been selected and described for the purpose of explaining the specific principles of the invention and their practical application, thereby enabling those skilled in the art to realize and utilize a variety of exemplary embodiments of the invention and various options and modifications. The scope of the invention is intended to be defined by the claims and their equivalents.

Claims

1. A permission control method based on RBAC, characterized in that: The method comprises: Receive a request signal and confirm the permission space and permission space sequence number corresponding to the request signal; the request signal is a signal generated when a user requests a permission operation, the permission space is a permission control point, and the permission operation includes: function permission and / or data permission; Determine whether the role corresponding to the user contains the permission space; If so, obtaining the permission variable corresponding to the permission space; the permission variable represents the attribute of the permission operation; Obtaining the permission variable value according to the permission space sequence number; Determine whether the authority variable value is the same as the preset authority variable value of the role; If so, generating an operation signal according to the functional authority to enable the user to perform the permission operation, and / or obtaining data corresponding to the data authority and returning it to the user; The method of obtaining data corresponding to the data permission and returning the data to the user includes: Acquire first data, where the first data is an intersection of obtainable data corresponding to the permission variables under the same permission space sequence number; For any permission space corresponding to the data permission, take the union of the first data controlled by the sequence numbers of the permission spaces corresponding to the data permission to obtain the second data; Taking a union of the second data controlled by each permission space corresponding to the data permission to obtain third data; The third data is returned to the user.

2. The RBAC-based permission control method according to claim 1, characterized in that: The method further comprises: Determining a resource corresponding to the request signal; the resource represents an event requiring permission control; A permission space corresponding to the resource is acquired based on the resource.

3. The RBAC-based permission control method according to claim 2, characterized in that: The method further comprises: Obtaining a timeliness object; the timeliness object is used to define the validity of an object; the object includes: users, roles, resources, permission spaces, permission variables, the correspondence between users and roles, the correspondence between roles and resources, the correspondence between resources and permission spaces, the correspondence between roles and permission spaces, and the correspondence between permission spaces and permission variables; The effective object is calculated based on the time-sensitive object.

4. The RBAC-based permission control method according to claim 1, characterized in that: The method further includes: generating a no-authority result when the role corresponding to the user does not include the permission space or when the permission variable value is different from the preset permission variable value.

5. A permission control device based on RBAC, characterized in that: The device comprises: A receiving unit, configured to receive a request signal and confirm the permission space and permission space sequence number corresponding to the request signal; the request signal is a signal generated when a user requests a permission operation, the permission space is a permission control point, and the permission operation includes: function permission and / or data permission; A first judging unit, configured to judge whether the role corresponding to the user includes the permission space; A first acquiring unit is configured to acquire a permission variable corresponding to the permission space; the permission variable represents an attribute of the permission operation; A second obtaining unit, configured to obtain a permission variable value according to the permission space sequence number; A second judgment unit is used to judge whether the authority variable value is the same as the preset authority variable value of the role; a generating unit, configured to, if yes, generate an operation signal according to the functional authority to enable the user to perform the permission operation, and / or obtain data corresponding to the data authority and return the data to the user; The method of obtaining data corresponding to the data permission and returning the data to the user includes: Acquire first data, where the first data is an intersection of obtainable data corresponding to the permission variables under the same permission space sequence number; For any permission space corresponding to the data permission, take the union of the first data controlled by the sequence numbers of the permission spaces corresponding to the data permission to obtain the second data; Taking a union of the second data controlled by each permission space corresponding to the data permission to obtain third data; The third data is returned to the user.

6. A method for establishing an authority control model based on RBAC, characterized in that: The method comprises: Establishing an authority space, wherein the authority space is an authority control point; Establishing roles, and establishing associations between users and roles, and between the roles and the permission space; Establishing an authority variable and establishing an association relationship between the authority space and the authority variable; Set one or more permission variable values corresponding to the permission variable; Establishing a correspondence between the permission variable value and the permission space sequence number; Create a time-limited object; Establish an association relationship between time-limited objects and objects; the time-limited objects are used to define the validity of the objects; the objects include: users, roles, resources, permission spaces, permission variables, the correspondence between users and roles, the correspondence between roles and resources, the correspondence between resources and permission spaces, the correspondence between roles and permission spaces, and the correspondence between permission spaces and permission variables.

7. The method for establishing a permission control model based on RBAC according to claim 6, characterized in that: The method further includes: establishing resources corresponding to the permission space; the resources represent events requiring permission control.

8. A device for establishing an authority control model based on RBAC, characterized in that: The device comprises: A first establishing unit is used to establish an authority space; the authority space is an authority control point; A second establishing unit is used to establish a role, and establish an association relationship between the user and the role, and an association relationship between the role and the permission space; A third establishing unit is used to establish an authority variable and establish an association relationship between the authority space and the authority variable; A setting unit, configured to set one or more permission variable values corresponding to the permission variable; a fourth establishing unit, configured to establish a correspondence between the authority variable value and the authority space sequence number; The fifth establishing unit is used to establish a time-limited object; The sixth establishment unit is used to establish the association relationship between time-limited objects and objects; the time-limited objects are used to define the validity of the objects; the objects include: users, roles, resources, permission spaces, permission variables, the correspondence between users and roles, the correspondence between roles and resources, the correspondence between resources and permission spaces, the correspondence between roles and permission spaces, and the correspondence between permission spaces and permission variables.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, it implements the steps of the RBAC-based permission control method described in any one of claims 1-4, and / or the method for establishing the RBAC-based permission control model described in any one of claims 6-7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any one of the RBAC-based permission control methods according to claims 1-4, and / or the method for establishing the RBAC-based permission control model according to any one of claims 6-7.

Images